@aura-stack/auth 0.6.0 → 0.7.1

package/dist/{index-BkpwQ0l4.d.cts → index-1ADcIVGC.d.ts}

@@ -1,11 +1,17 @@
-import { ZodObject, ZodRawShape, ZodTypeAny, z } from "zod/v4";
-import { JWTPayload } from "@aura-stack/jose/jose";
-import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, Prettify, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
 import * as _$_aura_stack_router0 from "@aura-stack/router";
 import { ClientOptions, GlobalContext } from "@aura-stack/router";
+import { ZodObject, ZodRawShape, ZodTypeAny, infer as __Infer, z } from "zod/v4";
+import { Type } from "arktype";
+import { TObject, TProperties, TSchema, Type as Type$1 } from "typebox";
+import { JWK, JWTPayload } from "@aura-stack/jose/jose";
+import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
 import { SerializeOptions } from "@aura-stack/router/cookie";
-import * as _$zod from "zod";
+import * as valibot from "valibot";
+import { AnySchema, BaseSchema, InferOutput, ObjectEntries, ObjectSchema } from "valibot";
+import * as _$arktype_internal_variants_object_ts0 from "arktype/internal/variants/object.ts";
 import * as _$zod_v4_core0 from "zod/v4/core";
+import { infer as infer$1 } from "zod/v4/core";
+import * as _$zod from "zod";
 
 //#region src/schemas.d.ts
 /**
@@ -72,17 +78,6 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 };
 //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: z.ZodObject<{
-  sub: z.ZodString;
-  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
-}, z.core.$strip>;
-type UserShape = (typeof UserIdentity)["shape"];
-type UserIdentityType = z.infer<typeof UserIdentity>;
-declare const createIdentity: <S extends EditableShape<UserShape>>(shape: S) => z.ZodObject<{ -readonly [P in keyof S]: S[P] }, z.core.$strip>;
-//#endregion
 //#region src/api/createApi.d.ts
 declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
   /**
@@ -165,6 +160,43 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
   signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
 };
 //#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: z.ZodObject<{
+  sub: z.ZodString;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+}, z.core.$strip>;
+declare const UserIdentityValibot: valibot.ObjectSchema<{
+  readonly sub: valibot.StringSchema<undefined>;
+  readonly name: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly image: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly email: valibot.OptionalSchema<valibot.NullableSchema<valibot.SchemaWithPipe<readonly [valibot.StringSchema<undefined>, valibot.EmailAction<string, undefined>]>, undefined>, undefined>;
+}, undefined>;
+declare const UserIdentityArkType: _$arktype_internal_variants_object_ts0.ObjectType<{
+  sub: string;
+  name?: string | null | undefined;
+  image?: string | null | undefined;
+  email?: string | null | undefined;
+}, {}>;
+declare const UserIdentityTypeBox: Type$1.TObject<{
+  sub: Type$1.TString;
+  name: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  image: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  email: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+}>;
+type UserShape = typeof UserIdentity.shape;
+type UserShapeValibot = typeof UserIdentityValibot.entries;
+type UserShapeArkType = typeof UserIdentityArkType;
+type UserShapeTypeBox = typeof UserIdentityTypeBox.properties;
+type IsArkType<T extends Identities> = T extends EditableShapeArkType<UserShapeArkType> ? true : false;
+type IsZod<T extends Identities> = T extends EditableShape<UserShape> ? true : false;
+type IsValibot<T extends Identities> = T extends EditableShapeValibot<UserShapeValibot> ? true : false;
+type SchemaTypes = ZodObject<any> | valibot.ObjectSchema<any, undefined> | Type<{}> | Type$1.TObject;
+type Identities = EditableShape<UserShape> | EditableShapeValibot<UserShapeValibot> | EditableShapeArkType<UserShapeArkType> | EditableShapeTypebox<UserShapeTypeBox> | EditableUser;
+type ReturnShapeType<T> = T extends EditableShape<UserShape> ? z.ZodObject<T> : T extends EditableShapeValibot<UserShapeValibot> ? valibot.ObjectSchema<T, undefined> : T extends EditableShapeArkType<UserShapeArkType> ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? Type$1.TObject<T> : T extends EditableUser ? z.ZodObject<T> : never;
+declare const createIdentity: <S extends Identities>(shape: S) => ReturnShapeType<S>;
+//#endregion
 //#region src/shared/logger.d.ts
 /**
  * Log message definitions organized by category.
@@ -475,6 +507,16 @@ declare const logMessages: {
 declare const createLogEntry: <T extends keyof typeof logMessages>(key: T, overrides?: Partial<SyslogOptions>) => SyslogOptions;
 declare const createSyslogMessage: (options: SyslogOptions) => string;
 //#endregion
+//#region src/validator/registry.d.ts
+declare const createSchemaRegistry: <Identity extends SchemaTypes>(config: IdentityConfig<Identity>) => {
+  parse: (data?: unknown) => Promise<any>;
+  parseAsPartial: (data?: unknown) => Promise<any>;
+  parseWithJWT: (data?: unknown) => Promise<any>;
+  schema: any;
+  schemaAsPartial: any;
+  schemaWithJWT: any;
+};
+//#endregion
 //#region src/oauth/github.d.ts
 /**
  * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
@@ -1044,6 +1086,73 @@ interface AtlassianProfile {
  */
 declare const atlassian: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
 //#endregion
+//#region src/oauth/click-up.d.ts
+/**
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+interface ClickUpProfile {
+  user: {
+    id: number;
+    username: string;
+    email: string;
+    color: string;
+    profilePicture: string;
+    initials: string;
+    week_start_day: number;
+    global_font_support: boolean;
+    timezone: string;
+  };
+}
+/**
+ * ClickUp OAuth Provider
+ *
+ * @see [Click Up - Create your own app](https://help.clickup.com/hc/en-us/articles/6303422883095-Create-your-own-app-with-the-ClickUp-API)
+ * @see [Click Up - Authentication](https://developer.clickup.com/docs/authentication)
+ * @see [Click UP - Get Access Token](https://developer.clickup.com/reference/getaccesstoken)
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+declare const clickUp: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/dribbble.d.ts
+/**
+ * @see [Dribble - User](https://developer.dribbble.com/v2/user/)
+ */
+interface DribbbleDefault {
+  id: number;
+  name: string;
+  login: string;
+  html_url: string;
+  avatar_url: string;
+  bio: string;
+  location: string;
+  links?: {
+    web?: string;
+    twitter?: string;
+  };
+  created_at: string;
+}
+interface DribbbleTeams extends DribbbleDefault {
+  type: "Team";
+  updated_at: string;
+}
+interface DribbbleProfile extends DribbbleDefault {
+  type: "User";
+  /** Not documented but available in the API response */
+  email: string | null;
+  can_upload_shot: boolean;
+  pro: boolean;
+  followers_count: number;
+  teams: DribbbleTeams[];
+}
+/**
+ * Dribbble OAuth provider
+ *
+ * @see [Dribbble - Register Application](https://dribbble.com/account/applications/new)
+ * @see [Dribbble - OAuth](https://developer.dribbble.com/v2/oauth/)
+ * @see [Dribbble - User](https://developer.dribbble.com/v2/user/)
+ */
+declare const dribbble: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+//#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -1130,6 +1239,18 @@ declare const builtInOAuthProviders: {
     image?: string | null | undefined;
     email?: string | null | undefined;
   }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+  readonly clickUp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+  readonly dribbble: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
 };
 /**
  * Constructs OAuth provider configurations from an array of provider names or configurations.
@@ -1147,6 +1268,196 @@ declare const builtInOAuthProviders: {
 declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | OAuthProviderCredentials<any>)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any>>;
 type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders;
 //#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = infer$1<typeof UserIdentity>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPairFromEnv {
+  publicKey: string;
+  privateKey: string;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+type JWTMode = "signed" | "encrypted" | "sealed";
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = Prettify<{
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface GetStatelessSessionReturn<DefaultUser extends User = User> {
+  session: Session<DefaultUser> | null;
+  headers: Headers;
+}
+/**
+ * Abstraction layer for session management.
+ */
+interface SessionStrategy<DefaultUser extends User = User> {
+  /**
+   * Read and validate the session from an incoming request.
+   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   */
+  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  /**
+   * Create a session after successful authentication.
+   * Signs the JWT / writes the DB row / sets cookies.
+   */
+  createSession(session: User): Promise<string>;
+  /**
+   * Attempt to refresh using the refresh token cookie.
+   * Returns null session + cookie-clearing response on any failure.
+   */
+  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
+    session: Session<DefaultUser> | null;
+    headers: Headers;
+  }>;
+  /**
+   * Revoke a session by ID.
+   * JWT strategy: best-effort (clears cookies, no server state).
+   * Database / hybrid: marks row inactive.
+   */
+  revokeSession(sessionId: string): Promise<void>;
+  /**
+   * Destroy the session attached to this request (logout).
+   * Returns a response that clears cookies.
+   */
+  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
+}
+/** Inputs for constructing a session strategy implementation for a given identity schema. */
+interface CreateSessionStrategyOptions<Identity extends Identities> {
+  config?: SessionConfig;
+  jose: JoseInstance<FromShapeToObject<Identity> & User>;
+  cookies: () => CookieStoreConfig;
+  logger?: InternalLogger;
+  identity: SchemaRegistryContext;
+}
+/** Options specialized for the JWT-backed session strategy. */
+interface JWTStrategyOptions<DefaultUser extends User = User> {
+  config?: StatelessStrategyConfig;
+  jose: JoseInstance<DefaultUser>;
+  logger?: InternalLogger;
+  cookies: () => CookieStoreConfig;
+  identity: SchemaRegistryContext;
+}
+/** Minimal token issue/verify surface used by session code paths. */
+type JWTManager<DefaultUser extends User = User> = {
+  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
+  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
 //#region src/@types/oauth.d.ts
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
@@ -1214,7 +1525,7 @@ type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<
  * Main configuration interface for Aura Auth.
  * This is the user-facing configuration object passed to `createAuth()`.
  */
-interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+type AuthConfig<Identity extends Identities> = {
   /**
    * OAuth providers available in the authentication and authorization flows. It provides a type-inference
    * for the OAuth providers that are supported by Aura Stack Auth; alternatively, you can provide a custom
@@ -1245,7 +1556,7 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * ]
    * ```
    */
-  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, ShapeToObject<Identity>>)[];
+  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, FromShapeToObject<Identity>>)[];
   /**
    * Cookie options defines the configuration for cookies used in Aura Auth.
    * It includes a prefix for cookie names and flag options to determine
@@ -1269,6 +1580,27 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * Secret used to sign and verify JWT tokens for session and csrf protection.
    * If not provided, it will load from the environment variable `AURA_AUTH_SECRET` or `AUTH_SECRET`, but if it
    * doesn't exist, it will throw an error during the initialization of the Auth module.
+   *
+   * > It can be a string, a Uint8Array, a CryptoKey, a CryptoKeyPair, or an object containing separate keys for
+   * signing and encryption. It depends on the JWT mode and algorithms you choose in the session configuration.
+   * The default mode is "sealed" (signing + encryption), so if the secret is a string or Uint8Array, it will derive
+   * separate keys for signing and encryption using HKDF, but if you provide a CryptoKeyPair, it will required to
+   * pass separate keys for signing and encryption in the `CryptoSecret` format.
+   * @example
+   * import { createSecretValue } from "@aura-stack/auth/crypto"
+   *
+   * secret: createSecretValue(32)
+   *
+   * // For asymmetric keys, generate a key pair and pass the private
+   * import { createKeyPair } from "@aura-stack/auth/crypto"
+   *
+   * const signing = await createKeyPair("RS256", { extractable: true })
+   * const encryption = await createKeyPair("RSA-OAEP-256", { extractable: true })
+   *
+   * secret: {
+   *   sign: signing,
+   *   encrypt: encryption,
+   * }
    */
   secret?: JWTKey;
   /**
@@ -1279,45 +1611,11 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * Base path for all authentication routes. Default is `/auth`.
    */
   basePath?: `/${string}`;
-  /**
-   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
-   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
-   * to determine the original client IP address and protocol.
-   *
-   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
-   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
-   * inaccurate client IP logging.
-   *
-   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
-   *
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
-   * @experimental
-   */
-  trustedProxyHeaders?: boolean;
   /**
    * Logger configuration for handling authentication-related logs and errors. It can be set to `true`,
    * `DEBUG=true`, `LOG_LEVEL=debug`, or a custom logger. It implements the syslog format.
    */
   logger?: boolean | Logger;
-  /**
-   * Defines trusted origins for your application to prevent open redirect attacks.
-   * URLs from the Referer header, Origin header, request URL, and redirectTo option
-   * are validated against this list before redirecting.
-   *
-   * - **Exact URL**: `https://example.com` matches only that origin.
-   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
-   * @example
-   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
-   *
-   *
-   * trustedOrigins: async (request) => {
-   *   const origin = new URL(request.url).origin
-   *   return [origin, "https://admin.example.com"]
-   * }
-   */
-  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
   /**
    * Defines the session management strategy for Aura Auth. It determines how sessions are created, stored, and validated.
    */
@@ -1344,36 +1642,131 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * }
    */
   identity?: Partial<{
+    /**
+     * Skip schema validation for session data, JWT payloads, and OAuth profiles.
+     * This can be useful for performance optimization if you are certain that the
+     * data is valid, but it can lead to security vulnerabilities if misused.
+     * > ⚠️ WARNING: Use this option with caution.
+     */
     skipValidation: boolean;
-    schema: ZodObject<Identity>;
+    /**
+     * Custom schema validation for user identity data. It supports any Zod, Arktype,
+     * Valibot or Typebox schema. Use `createIdentity` helper function to create a schema
+     * with the correct shape and inference.
+     */
+    schema: ConfigSchema<Identity>;
+    /**
+     * Defines how unknown keys are handled during schema validation. It can be set to:
+     * - `passthrough`: Unknown keys are allowed and included in the validated data.
+     * - `strict`: Unknown keys will cause validation to fail with an error.
+     * - `strip`: Unknown keys are removed from the validated data.
+     */
     unknownKeys: "passthrough" | "strict" | "strip";
   }>;
   /**
    * Credentials provider for username/password or similar authentication.
    */
   credentials?: CredentialsProvider<Identity>;
-}
+} & TrustedProxyHeadersConfig;
+type TrustedProxyHeadersConfig = {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders: true;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   */
+  trustedOrigins: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+} | {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders?: false;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   *
+   */
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+};
 /**
  * Cookie type with __Secure- prefix, must be Secure.
  * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
  */
 type SecureCookie = {
   strategy: "secure";
-} & Prettify$1<Omit<SerializeOptions, "secure" | "encode">>;
+} & Prettify<Omit<SerializeOptions, "secure" | "encode">>;
 /**
  * Cookie type with __Host- prefix, must be Secure, Path=/, no Domain attribute.
  * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
  */
 type HostCookie = {
   strategy: "host";
-} & Prettify$1<Omit<SerializeOptions, "secure" | "path" | "domain" | "encode">>;
+} & Prettify<Omit<SerializeOptions, "secure" | "path" | "domain" | "encode">>;
 /**
  * Standard cookie type without security prefixes.
  * Can be sent over both HTTP and HTTPS connections (default in development).
  */
 type StandardCookie = {
   strategy?: "standard";
-} & Prettify$1<Omit<SerializeOptions, "encode">>;
+} & Prettify<Omit<SerializeOptions, "encode">>;
 /**
  * Union type for cookie options based on the specified strategy.
  * - `secure`: Cookies are only sent over HTTPS connections
@@ -1386,10 +1779,9 @@ type CookieStrategyAttributes = StandardCookie | SecureCookie | HostCookie;
  * - `sessionToken`: User session JWT
  * - `csrfToken`: CSRF protection token
  * - `state`: OAuth state parameter for CSRF protection
- * - `code_verifier`: PKCE code verifier for authorization code flow
- * - `redirect_uri`: OAuth callback URI
- * - `redirect_to`: Post-authentication redirect path
- * - `nonce`: OpenID Connect nonce parameter
+ * - `codeVerifier`: PKCE code verifier for authorization code flow
+ * - `redirectURI`: OAuth callback URI
+ * - `redirectTo`: Post-authentication redirect path
  */
 type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI";
 /** Resolved cookie names and serialization attributes for each logical auth cookie. */
@@ -1402,6 +1794,10 @@ interface CookieConfig {
    * Prefix to be added to all cookie names. By default "aura-stack".
    */
   prefix?: string;
+  /**
+   * Overrides for individual cookie configurations.
+   * @see {@link CookieStoreConfig} for the structure of each cookie configuration.
+   */
   overrides?: Partial<CookieStoreConfig>;
 }
 /**
@@ -1454,8 +1850,9 @@ interface InternalLogger {
  * Identity validation settings used when building session strategy and OAuth profile mapping.
  * Controls the Zod schema and how unknown keys are handled on user objects.
  */
-interface IdentityConfig<Schema extends ZodObject<any> = typeof UserIdentity> {
+interface IdentityConfig<Schema extends SchemaTypes = typeof UserIdentity> {
   schema?: Schema;
+  schemaAsPartial?: Schema;
   skipValidation?: boolean;
   unknownKeys?: "passthrough" | "strict" | "strip";
 }
@@ -1485,14 +1882,14 @@ interface CredentialsProviderContext<T> {
 /**
  * Interface for the credentials provider.
  */
-interface CredentialsProvider<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+interface CredentialsProvider<Identity extends Identities> {
   hash?: (password: string, salt?: string, iterations?: number) => Promise<string>;
   verify?: (password: string, hashedPassword: string) => Promise<boolean>;
   /**
    * Authenticates a user using credentials.
    * Must return a User object or the identity type if the identity schema is provided.
    */
-  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<ShapeToObject<Identity> | null> | ShapeToObject<Identity> | null;
+  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<FromShapeToObject<Identity> | null> | FromShapeToObject<Identity> | null;
 }
 /**
  * Runtime context passed into auth actions and API handlers: OAuth map, cookies, JWT, session strategy, trusted origins, etc.
@@ -1510,11 +1907,12 @@ interface RouterGlobalContext<DefaultUser extends User = User> {
   trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
   logger?: InternalLogger;
   sessionStrategy: SessionStrategy<DefaultUser>;
-  identity: {
-    unknownKeys: "passthrough" | "strict" | "strip";
-    schema: ZodObject<any>;
-    skipValidation?: boolean;
-  };
+  identity: SchemaRegistryContext;
+}
+interface SchemaRegistryContext {
+  schemaRegistry: ReturnType<typeof createSchemaRegistry>;
+  skipValidation?: boolean;
+  unknownKeys: "passthrough" | "strict" | "strip";
 }
 /**
  * Internal runtime configuration used within Aura Auth after initialization.
@@ -1525,8 +1923,17 @@ type AuthRuntimeConfig<DefaultUser extends User = User> = RouterGlobalContext<De
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
 interface AuthInstance<DefaultUser extends User = User> {
+  /**
+   * Programmatic API for authentication actions (getSession, signIn, signOut, etc.) that can be used in server-side contexts or API routes.
+   */
   api: AuthAPI<DefaultUser>;
+  /**
+   * JOSE helper functions for signin, encryption and verification of JWTs.
+   */
   jose: JoseInstance<DefaultUser>;
+  /**
+   * HTTP handlers for mounting on a router or server.
+   */
   handlers: {
     GET: (request: Request) => Response | Promise<Response>;
     POST: (request: Request) => Response | Promise<Response>;
@@ -1537,199 +1944,16 @@ interface AuthInstance<DefaultUser extends User = User> {
 /**
  * Extended context used inside the library with both secure and standard cookie materializations.
  */
-type InternalContext<Identity extends EditableShape<UserShape>> = RouterGlobalContext<ShapeToObject<Identity> & User> & {
+type InternalContext<Identity extends Identities> = RouterGlobalContext<FromShapeToObject<Identity> & User> & {
   cookieConfig: {
     secure: CookieStoreConfig;
     standard: CookieStoreConfig;
   };
 };
 //#endregion
-//#region src/@types/session.d.ts
-/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = UserIdentityType;
-/**
- * Session data returned by the session endpoint.
- */
-interface Session<DefaultUser extends User = User> {
-  user: DefaultUser;
-  expires: string;
-}
-/**
- * A symmetric secret or asymmetric key pair used for JWT operations.
- *
- * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
- * - CryptoKey: Web Crypto API key, for environments that support it
- * - KeyPair: asymmetric signing (RS256, ES256, EdDSA, etc.)
- */
-type SecretKey = string | Uint8Array | CryptoKey;
-/** Asymmetric key pair for signing or key agreement (Web Crypto `CryptoKey` pair). */
-interface KeyPair {
-  privateKey: CryptoKey;
-  publicKey: CryptoKey;
-}
-/**
- * @todo: add key rotation support for "SecretKey | KeyPair | [SecretKey | KeyPair, ...(SecretKey | KeyPair)[]]"
- */
-type JWTKey = SecretKey;
-/**
- * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
- * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
- * - "sealed"    → JWS nested inside JWE (signed then encrypted).
- */
-type JWTMode = "signed" | "encrypted" | "sealed";
-/**
- * Signing algorithms for "signed" and "sealed" modes.
- * Symmetric: HS256 | HS384 | HS512
- * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
- */
-type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
-/**
- * Key-wrapping algorithms for "encrypted" and "sealed" modes.
- * Symmetric: A128KW | A192KW | A256KW | dir (direct)
- * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
- * RSA:       RSA-OAEP | RSA-OAEP-256
- */
-type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
-/** Content-encryption algorithms for JWE. */
-type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
-/** Signed JWT mode configuration. */
-type JWTSignedMode = {
-  mode: "signed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-};
-/** Encrypted JWT mode configuration. */
-type JWTEncryptedMode = {
-  mode: "encrypted";
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Signed and Encrypted JWT mode configuration. */
-type JWTSealedMode = {
-  mode?: "sealed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
-type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
-type JWTConfig = {
-  /**
-   * Token lifetime.
-   */
-  maxAge?: number;
-  /**
-   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
-   * @example "https://auth.example.com"
-   */
-  issuer?: string;
-  /**
-   * JWT `aud` claim. Single value or array for multi-audience tokens.
-   * @example ["https://api.example.com", "https://app.example.com"]
-   */
-  audience?: string | string[];
-  /**
-   * Maximum absolute session duration in seconds.
-   * Required for "absolute" and "sliding" strategies.
-   * Enforced via jose's maxTokenAge against the iat claim.
-   */
-  maxExpiration?: number;
-  /**
-   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
-   */
-  expirationStrategy?: JWTExpirationStrategy;
-} & JWTConfigBase;
-/**
- * Stateless JWT strategy.
- * No database required. Tokens are self-contained and cannot be revoked
- * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
- *
- * @example
- * {
- *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
- * }
- */
-type StatelessStrategyConfig = {
-  strategy?: "jwt";
-  jwt?: JWTConfig;
-};
-/**
- * The session strategy. Determines which fields below are required.
- *
- * - "jwt": stateless. No database needed. JWTs are self-contained.
- * - "database": stateful. Every request hits the DB to validate the session.
- * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
- *
- * @default "jwt"
- */
-type SessionConfig = StatelessStrategyConfig;
-/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
-interface GetStatelessSessionReturn<DefaultUser extends User = User> {
-  session: Session<DefaultUser> | null;
-  headers: Headers;
-}
-/**
- * Abstraction layer for session management.
- */
-interface SessionStrategy<DefaultUser extends User = User> {
-  /**
-   * Read and validate the session from an incoming request.
-   * Returns null if absent, invalid, or expired. Never throws on auth failure.
-   */
-  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
-  /**
-   * Create a session after successful authentication.
-   * Signs the JWT / writes the DB row / sets cookies.
-   */
-  createSession(session: User): Promise<string>;
-  /**
-   * Attempt to refresh using the refresh token cookie.
-   * Returns null session + cookie-clearing response on any failure.
-   */
-  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
-    session: Session<DefaultUser> | null;
-    headers: Headers;
-  }>;
-  /**
-   * Revoke a session by ID.
-   * JWT strategy: best-effort (clears cookies, no server state).
-   * Database / hybrid: marks row inactive.
-   */
-  revokeSession(sessionId: string): Promise<void>;
-  /**
-   * Destroy the session attached to this request (logout).
-   * Returns a response that clears cookies.
-   */
-  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
-}
-/** Inputs for constructing a session strategy implementation for a given identity schema. */
-interface CreateSessionStrategyOptions<Identity extends EditableShape<UserShape>> {
-  config?: SessionConfig;
-  jose: JoseInstance<ShapeToObject<Identity> & User>;
-  cookies: () => CookieStoreConfig;
-  logger?: InternalLogger;
-  identity: IdentityConfig;
-}
-/** Options specialized for the JWT-backed session strategy. */
-interface JWTStrategyOptions<DefaultUser extends User = User> {
-  config?: StatelessStrategyConfig;
-  jose: JoseInstance<DefaultUser>;
-  logger?: InternalLogger;
-  cookies: () => CookieStoreConfig;
-  identity: IdentityConfig;
-}
-/** Minimal token issue/verify surface used by session code paths. */
-type JWTManager<DefaultUser extends User = User> = {
-  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
-  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
-};
-//#endregion
 //#region src/@types/utility.d.ts
 /** Expands intersection types into a single flat object type for readable editor hints. */
-type Prettify$1<T> = { [K in keyof T]: T[K] };
+type Prettify<T> = { [K in keyof T]: T[K] };
 /**
  * A string that must be one of the literals in `T`, or any other string (`U`).
  * Useful for autocomplete on known keys while still allowing custom values.
@@ -1739,33 +1963,97 @@ type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
  * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
  */
 type EditableShape<T extends ZodRawShape> = { [K in keyof T]: T[K] extends ZodObject<infer Inner extends ZodRawShape> ? ZodObject<EditableShape<Inner>> : ZodTypeAny };
+type EditableShapeZod<T extends ZodRawShape> = EditableShape<T>;
+type AnyShape = Record<string, AnySchema>;
+type EditableShapeValibot<T extends ObjectEntries> = { [K in keyof T]: T[K] extends ObjectSchema<infer Inner extends AnyShape, undefined> ? ObjectSchema<EditableShapeValibot<Inner>, undefined> : BaseSchema<any, any, any> };
+type EditableShapeTypebox<T extends TProperties> = { [K in keyof T]: T[K] extends TObject ? Wrap<EditableShapeTypebox<T[K]["properties"]>> : TSchema };
+type EditableUser = { [K in keyof User]: any };
+type ConfigSchema<T extends Identities> = IsZod<T> extends true ? ZodObject<T & ZodRawShape> : T extends EditableShapeValibot<UserShapeValibot> ? ObjectSchema<T & ObjectEntries, undefined> : IsArkType<T> extends true ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? TObject<T & TProperties> : never;
+type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
+type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
+type TypeboxShapeToObject<S> = Wrap<Merge<S, User>>;
+type EditableShapeArkType<T extends Type> = T extends Type<infer Shape> ? Type<{ [K in keyof Shape]: any }> : never;
 /** Merges type `B` over `A`, replacing overlapping keys with `B`. */
 type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
  * so identity fields always include the base user contract.
  */
-type ShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<{ [K in keyof S]: z.infer<S[K]> }, User>;
+type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<__Infer<ZodObject<S>>, User>;
+type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : S extends User ? S : never;
 /** Recursively makes every property required. */
 type DeepRequired<T> = { [K in keyof T]-?: T[K] extends object ? DeepRequired<T[K]> : T[K] };
 /** Recursively makes every property optional. */
 type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
-/** Resolves the user identity type from an {@link AuthInstance} config, or falls back to {@link User}. */
-type InferAuthIdentity<Config> = Config extends AuthInstance<infer Identity> ? Prettify$1<Identity> : User;
-/** Shorthand for a Zod object’s `.shape` property. */
-type InferShape<T extends ZodObject> = T["shape"];
-/** Runtime user object type inferred from a Zod identity schema. */
-type InferIdentity<T extends ZodObject> = ShapeToObject<InferShape<T>>;
+/** Wraps a type in an object with the same keys. */
+type Wrap<T> = T extends any ? { [K in keyof T]: T[K] } : never;
+/**
+ * Infers the user type from an {@link AuthInstance} config, or falls back to {@link User}.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type User = InferUser<typeof auth>
+ */
+type InferUser<Config extends AuthInstance> = Config extends AuthInstance<infer Identity> ? Prettify<Identity> : User;
+/**
+ * Infers the session type from an {@link AuthInstance} config.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type Session = InferSession<typeof auth>
+ */
+type InferSession<Config extends AuthInstance> = Prettify<Session<Wrap<InferUser<Config>>>>;
+/**
+ * Shorthand for a Zod object’s `.shape` property.
+ */
+type InferZodShape<T extends ZodObject> = T["shape"];
+/**
+ * Infers the user type from a Zod identity schema, or falls back to {@link User}.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type User = UserFrom<typeof schema>
+ */
+type UserFrom<T extends ZodObject> = Prettify<ZodShapeToObject<InferZodShape<T>>>;
+/**
+ * Infers the session type from a Zod identity schema.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type Session = SessionFrom<typeof schema>
+ */
+type SessionFrom<T extends ZodObject> = Wrap<Session<Wrap<UserFrom<T>>>>;
 /**
  * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
  */
-type AuthResponse<Body = unknown> = Prettify$1<Omit<Response, "json"> & {
+type AuthResponse<Body = unknown> = Prettify<Omit<Response, "json"> & {
   json(): Promise<Body>;
 }>;
+type RequiredKeys<Obj extends object, Keys extends keyof Obj = keyof Obj> = Wrap<{ [K in Keys]-?: Obj[K] } & Omit<Obj, Keys>>;
 //#endregion
 //#region src/createAuth.d.ts
-declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(authConfig: AuthConfig<Identity>) => {
-  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"GET", "/signIn/:oauth", {
+declare const createAuthInstance: <Identity extends Identities>(authConfig: AuthConfig<Identity>) => {
+  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"/signIn/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
     schemas?: {
       params: _$zod.ZodObject<{
         oauth: _$zod.ZodEnum<{
@@ -1784,6 +2072,8 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
           notion: "notion";
           dropbox: "dropbox";
           atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
         }>;
       }, _$zod_v4_core0.$strip>;
       searchParams: _$zod.ZodObject<{
@@ -1791,17 +2081,85 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signIn/credentials", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signIn/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+    params: _$zod.ZodObject<{
+      oauth: _$zod.ZodEnum<{
+        [x: string & Record<never, never>]: string & Record<never, never>;
+        github: "github";
+        bitbucket: "bitbucket";
+        figma: "figma";
+        discord: "discord";
+        gitlab: "gitlab";
+        spotify: "spotify";
+        x: "x";
+        strava: "strava";
+        mailchimp: "mailchimp";
+        pinterest: "pinterest";
+        twitch: "twitch";
+        notion: "notion";
+        dropbox: "dropbox";
+        atlassian: "atlassian";
+        clickUp: "clickUp";
+        dribbble: "dribbble";
+      }>;
+    }, _$zod_v4_core0.$strip>;
+    searchParams: _$zod.ZodObject<{
+      redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+      redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: boolean;
+      signInURL: string;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      signInURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
     schemas?: {
       body: _$zod.ZodObject<{
         username: _$zod.ZodString;
         password: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>;
       searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/callback/:oauth", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+    body: _$zod.ZodObject<{
+      username: _$zod.ZodString;
+      password: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+    searchParams: _$zod.ZodObject<{
+      redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+      redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: true;
+      redirectURL: null;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: string;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/callback/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
     schemas?: {
       params: _$zod.ZodObject<{
         oauth: _$zod.ZodEnum<{
@@ -1820,6 +2178,8 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
           notion: "notion";
           dropbox: "dropbox";
           atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
         }>;
       }, _$zod_v4_core0.$strip>;
       searchParams: _$zod.ZodObject<{
@@ -1827,30 +2187,139 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
         state: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/session", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/callback/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+    params: _$zod.ZodObject<{
+      oauth: _$zod.ZodEnum<{
+        [x: string & Record<never, never>]: string & Record<never, never>;
+        github: "github";
+        bitbucket: "bitbucket";
+        figma: "figma";
+        discord: "discord";
+        gitlab: "gitlab";
+        spotify: "spotify";
+        x: "x";
+        strava: "strava";
+        mailchimp: "mailchimp";
+        pinterest: "pinterest";
+        twitch: "twitch";
+        notion: "notion";
+        dropbox: "dropbox";
+        atlassian: "atlassian";
+        clickUp: "clickUp";
+        dribbble: "dribbble";
+      }>;
+    }, _$zod_v4_core0.$strip>;
+    searchParams: _$zod.ZodObject<{
+      code: _$zod.ZodString;
+      state: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"/session", "GET", {
     schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signOut", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/session", "GET", _$_aura_stack_router0.EndpointSchemas>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
     schemas?: {
       searchParams: _$zod.ZodObject<{
-        token_type_hint: _$zod.ZodLiteral<"session_token">;
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+        token_type_hint: _$zod.ZodLiteral<"session_token">;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/csrfToken", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+    searchParams: _$zod.ZodObject<{
+      redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+      redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      token_type_hint: _$zod.ZodLiteral<"session_token">;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: true;
+      redirectURL: null;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: string;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/csrfToken", "GET", {
     schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"PATCH", "/session", {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/csrfToken", "GET", _$_aura_stack_router0.EndpointSchemas>>) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
     schemas?: {
-      body: _$zod.ZodObject<{
-        user: _$zod.ZodOptional<_$zod.ZodObject<{
-          sub: _$zod.ZodOptional<_$zod.ZodString>;
-          name: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
-          image: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
-          email: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodEmail>>>;
-        }, _$zod_v4_core0.$strip>> | undefined;
-        expires: _$zod.ZodOptional<_$zod.ZodCoercedDate<unknown>>;
+      body: any;
+      searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>]>;
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+    body: any;
+    searchParams: _$zod.ZodObject<{
+      redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+      redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+      redirect: true;
+      redirectURL: null;
+    } | {
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+      redirect: false;
+      redirectURL: string;
+    } | {
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }>>>]>;
   jose: any;
   api: {
     getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<{
@@ -1898,7 +2367,7 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
  *   }]
  * })
  */
-declare const createAuth: <Identity extends EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<ShapeToObject<Identity>>;
+declare const createAuth: <Identity extends Identities = EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<FromShapeToObject<Identity>>;
 //#endregion
 //#region src/@types/errors.d.ts
 /** Map of field or logical keys to API validation error payloads (code + message). */
@@ -1934,7 +2403,7 @@ type ErrorType = AuthorizationError["error"] | AccessTokenError["error"] | Token
  * Machine-readable codes for internal auth failures (configuration, crypto, environment, etc.).
  * Used with {@link AuthInternalError} and logging.
  */
-type AuthInternalErrorCode = "INVALID_OAUTH_CONFIGURATION" | "INVALID_JWT_TOKEN" | "JOSE_INITIALIZATION_FAILED" | "SESSION_STORE_NOT_INITIALIZED" | "COOKIE_STORE_NOT_INITIALIZED" | "COOKIE_PARSING_FAILED" | "COOKIE_NOT_FOUND" | "INVALID_ENVIRONMENT_CONFIGURATION" | "INVALID_URL" | "INVALID_SALT_SECRET_VALUE" | "UNTRUSTED_ORIGIN" | "INVALID_OAUTH_PROVIDER_CONFIGURATION" | "DUPLICATED_OAUTH_PROVIDER_ID" | "CREDENTIALS_PROVIDER_NOT_CONFIGURED" | "IDENTITY_VALIDATION_FAILED";
+type AuthInternalErrorCode = "INVALID_OAUTH_CONFIGURATION" | "INVALID_JWT_TOKEN" | "JOSE_INITIALIZATION_FAILED" | "SESSION_STORE_NOT_INITIALIZED" | "COOKIE_STORE_NOT_INITIALIZED" | "COOKIE_PARSING_FAILED" | "COOKIE_NOT_FOUND" | "INVALID_ENVIRONMENT_CONFIGURATION" | "INVALID_URL" | "INVALID_SALT_SECRET_VALUE" | "UNTRUSTED_ORIGIN" | "INVALID_OAUTH_PROVIDER_CONFIGURATION" | "DUPLICATED_OAUTH_PROVIDER_ID" | "CREDENTIALS_PROVIDER_NOT_CONFIGURED" | "IDENTITY_VALIDATION_FAILED" | "UPDATE_SESSION_INVALID";
 /**
  * Machine-readable codes for security-sensitive failures (CSRF, session, open redirect, OAuth state).
  */
@@ -2004,7 +2473,7 @@ interface APIOptionsWithRedirectTo {
   /**
    * Optional redirect strategy for server/programmatic API functions.
    *
-   * - `true`: the generated response is a redirect response.
+   * - `true`: The response includes a `Location` header.
    * - `false`: the API returns redirect data (`signInURL` or `redirectURL`) for custom handling.
    *
    * Defaults are action-specific; see each API option type.
@@ -2126,16 +2595,32 @@ interface SignInCredentialsOptions extends OptionsWithRedirectTo {
    */
   payload: CredentialsPayload;
 }
-/** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
-type SignInCredentialsReturn<Options extends SignInCredentialsOptions> = Options extends {
-  redirect: false;
-} ? {
+type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  redirectURL: null;
+} /** redirect: false & redirectTo: string */ | {
   success: true;
+  redirect: false;
   redirectURL: string;
-} | {
+}
+/** redirect: false & redirectTo: null | undefined (not set) */
+/** redirect: true & redirectTo: null | undefined (not set) */
+| {
+  success: true;
+  redirect: false;
+  redirectURL: null;
+} /** Failed credentials */ | {
   success: false;
+  redirect: false;
   redirectURL: null;
-} : void;
+};
+/** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
+type SignInCredentialsReturn<Options extends SignInCredentialsOptions> = Options extends {
+  redirect: false;
+} ? Extract<SignInCredentialsReturnData, {
+  redirect: false;
+}> : void;
 /** Server/programmatic credentials sign-in options. */
 interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {
   /**
@@ -2149,83 +2634,73 @@ interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptio
   payload: CredentialsPayload;
 }
 /** Programmatic credentials sign-in result with response metadata and `toResponse()`. */
-type SignInCredentialsAPIReturn = AuthActionAPIReturn<{
-  success: true;
-  redirectURL: string;
-} | {
-  success: false;
-  redirectURL: null;
-}>;
+type SignInCredentialsAPIReturn = AuthActionAPIReturn<SignInCredentialsReturnData>;
 /** Client-side sign-out options. */
 interface SignOutOptions extends OptionsWithRedirectTo {}
-/** Client-side sign-out return type (redirect mode or manual redirect data). */
-type SignOutReturn<Options extends SignOutOptions> = Options extends {
-  redirect: false;
-} ? {
+type SignOutReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  redirectURL: null;
+} /** redirect: false & redirectTo: string */ | {
   success: true;
   redirect: false;
   redirectURL: string;
-} | {
+}
+/** redirect: false & redirectTo: null | undefined (not set) */
+/** redirect: true & redirectTo: null | undefined (not set) */
+| {
+  success: true;
+  redirect: false;
+  redirectURL: null;
+} /** Failed */ | {
   success: false;
   redirect: false;
   redirectURL: null;
-} : void;
+};
+/** Client-side sign-out return type (redirect mode or manual redirect data). */
+type SignOutReturn<Options extends SignOutOptions> = Options extends {
+  redirect: false;
+} ? Extract<SignOutReturnData, {
+  redirect: false;
+}> : void;
 /** Server/programmatic options for `signOut` API. */
-interface SignOutAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
-  /**
-   * Required headers used to execute sign-out.
-   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
-   * @example
-   * {
-   *   Cookie: "session_token=abc123; csrf_token=def456"
-   * }
-   */
-  headers: HeadersInit;
-  /**
-   * Optional `Request` object as an alternative to manually providing `headers`.
-   */
-  request?: Request;
-}
+interface SignOutAPIOptions extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {}
 /** Programmatic sign-out result with redirect metadata and `toResponse()`. */
-type SignOutAPIReturn = AuthActionAPIReturn<{
-  success: true;
-  redirect: boolean;
-  redirectURL: string;
-} | {
-  success: false;
-  redirect: boolean;
-  redirectURL: null;
-}>;
+type SignOutAPIReturn = AuthActionAPIReturn<SignOutReturnData>;
 /** Client-side `updateSession` options: partial session payload plus optional redirect behavior. */
 interface UpdateSessionOptions<DefaultUser extends User = User> extends OptionsWithRedirectTo {
   /** Partial session data to merge into the current session. */
   session: DeepPartial<Session<DefaultUser>>;
 }
-/** Client-side `updateSession` return type. */
-type UpdateSessionReturn<Options extends UpdateSessionOptions, DefaultUser extends User = User> = Options extends {
+type UpdateSessionReturnData<DefaultUser extends User = User> = /** redirect: true & redirectTo: string */{
+  success: true;
+  session: Session<DefaultUser>;
+  redirect: true;
+  redirectURL: null;
+} /** redirect: false & redirectTo: string */ | {
+  success: true;
+  session: Session<DefaultUser>;
   redirect: false;
-} ? {
+  redirectURL: string;
+} /** redirect: false & redirectTo: null | undefined (not set) */ | {
   success: true;
   session: Session<DefaultUser>;
-} | {
+  redirect: false;
+  redirectURL: null;
+} /** Failed session update */ | {
   success: false;
   session: null;
-} : void;
+  redirect: false;
+  redirectURL: null;
+};
+/** Client-side `updateSession` return type. */
+type UpdateSessionReturn<Options extends UpdateSessionOptions<DefaultUser>, DefaultUser extends User = User> = Options extends {
+  redirect: false;
+} ? Extract<UpdateSessionReturnData<DefaultUser>, {
+  redirect: false;
+}> : void;
 /** Server/programmatic options for `updateSession` API. */
-interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
-  /**
-   * Required headers used to execute session update.
-   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
-   * @example
-   * {
-   *  Cookie: "session_token=abc123; csrf_token=def456"
-   * }
-   */
-  headers: HeadersInit;
-  /**
-   * Optional `Request` object as an alternative to manually providing `headers`.
-   */
-  request?: Request;
+interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {
   /**
    * Partial session payload used to update the current session.
    * @see Session
@@ -2240,15 +2715,7 @@ interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends APIOp
   session: DeepPartial<Session<DefaultUser>>;
 }
 /** Programmatic session update result with redirect metadata and `toResponse()`. */
-type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<{
-  success: true;
-  session: Session<DefaultUser>;
-  redirectURL: string;
-} | {
-  success: false;
-  session: null;
-  redirectURL: null;
-}>;
+type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>;
 //#endregion
 //#region src/@types/index.d.ts
 /**
@@ -2272,8 +2739,8 @@ type AuthClient = ReturnType<typeof createAuthInstance>["handlers"];
  * Options for {@link createAuthClient} (browser HTTP client). Extends the router client with an optional `baseURL`
  * when the client runs outside the browser (e.g. server-side fetch to your app origin).
  */
-type AuthClientOptions = Prettify$1<Omit<ClientOptions, "baseURL"> & {
+type AuthClientOptions = Prettify<Omit<ClientOptions, "baseURL"> & {
   baseURL?: string;
 }>;
 //#endregion
-export { JWTConfigBase as $, atlassian as $t, APIErrorMap as A, DiscordProfile as An, IdentityConfig as At, DeepPartial as B, UserIdentity as Bn, SyslogOptions as Bt, SignOutAPIReturn as C, XProfile as Cn, CookieName as Ct, UpdateSessionAPIReturn as D, spotify as Dn, CredentialsProvider as Dt, UpdateSessionAPIOptions as E, SpotifyProfile as En, CredentialsPayload as Et, ErrorType as F, BitbucketProfile as Fn, Logger as Ft, InferShape as G, OAuthProviderCredentials as Gt, EditableShape as H, UserShape as Hn, AuthorizeParams as Ht, OAuthError as I, bitbucket as In, RouterGlobalContext as It, Prettify$1 as J, BuiltInOAuthProvider as Jt, LiteralUnion as K, OAuthProviderRecord as Kt, TokenRevocationError as L, GitHubProfile as Ln, SecureCookie as Lt, AuthInternalErrorCode as M, discord as Mn, InternalLogger as Mt, AuthSecurityErrorCode as N, FigmaProfile as Nn, JoseInstance as Nt, UpdateSessionOptions as O, GitLabProfile as On, CredentialsProviderContext as Ot, AuthorizationError as P, figma as Pn, LogLevel as Pt, JWTConfig as Q, ExtendedProfile as Qt, createAuth as R, github as Rn, Severity as Rt, SignOutAPIOptions as S, strava as Sn, CookieConfig as St, SignOutReturn as T, SpotifyImage as Tn, CookieStrategyAttributes as Tt, InferAuthIdentity as U, createIdentity as Un, OAuthProvider as Ut, DeepRequired as V, UserIdentityType as Vn, TrustedOrigin as Vt, InferIdentity as W, OAuthProviderConfig as Wt, CreateSessionStrategyOptions as X, createBuiltInOAuthProviders as Xt, ShapeToObject as Y, builtInOAuthProviders as Yt, GetStatelessSessionReturn as Z, AtlassianProfile as Zt, SignInCredentialsAPIReturn as _, MailchimpProfile as _n, User as _t, OAuthEnv as a, dropbox as an, JWTManager as at, SignInOptions as b, SummaryClub as bn, AuthInstance as bt, APIOptionsWithRequest as c, NotionUser as cn, JWTSignedMode as ct, GetSessionAPIOptions as d, notion as dn, KeyPair as dt, AccountType as en, JWTEncryptedMode as et, GetSessionAPIReturn as f, TwitchProfile as fn, SecretKey as ft, SignInCredentialsAPIOptions as g, Login as gn, StatelessStrategyConfig as gt, SignInAPIReturn as h, pinterest as hn, SessionStrategy as ht, JWTStandardClaims as i, RootInfo as in, JWTKeyAlgorithm as it, AccessTokenError as j, Nameplate as jn, InternalContext as jt, UpdateSessionReturn as k, gitlab as kn, HostCookie as kt, APIOptionsWithSkipCSRFCheck as l, Owner as ln, JWTSigningAlgorithm as lt, SignInAPIOptions as m, PinterestProfile as mn, SessionConfig as mt, AuthClientOptions as n, FullTeam as nn, JWTExpirationStrategy as nt, TypedJWTPayload$1 as o, Bot as on, JWTMode as ot, OptionsWithRedirectTo as p, twitch as pn, Session as pt, Merge as q, ResponseType as qt, JWTPayloadWithToken as r, Name as rn, JWTKey as rt, APIOptionsWithRedirectTo as s, NotionProfile as sn, JWTSealedMode as st, AuthClient as t, DropboxProfile as tn, JWTEncryptionAlgorithm as tt, FunctionAPIContext as u, Person as un, JWTStrategyOptions as ut, SignInCredentialsOptions as v, mailchimp as vn, AuthAPI as vt, SignOutOptions as w, x as wn, CookieStoreConfig as wt, SignInReturn as x, SummaryGear as xn, AuthRuntimeConfig as xt, SignInCredentialsReturn as y, StravaProfile as yn, AuthConfig as yt, AuthResponse as z, createSyslogMessage as zn, StandardCookie as zt };
+export { FromShapeToObject as $, SpotifyProfile as $n, JWTEncryptionAlgorithm as $t, UpdateSessionOptions as A, Name as An, Logger as At, TokenRevocationError as B, twitch as Bn, OAuthProvider as Bt, SignOutAPIOptions as C, clickUp as Cn, UserShapeArkType as Cr, CredentialsProviderContext as Ct, SignOutReturnData as D, AccountType as Dn, InternalLogger as Dt, SignOutReturn as E, atlassian as En, createIdentity as Er, InternalContext as Et, AuthInternalErrorCode as F, NotionUser as Fn, StandardCookie as Ft, DeepPartial as G, mailchimp as Gn, AsymmetricKeyPair as Gt, ArktypeShapeToObject as H, pinterest as Hn, OAuthProviderCredentials as Ht, AuthSecurityErrorCode as I, Owner as In, SyslogOptions as It, EditableShapeArkType as J, SummaryGear as Jn, CryptoSecret as Jt, DeepRequired as K, StravaProfile as Kn, AsymmetricKeyPairFromEnv as Kt, AuthorizationError as L, Person as Ln, TrustedOrigin as Lt, UpdateSessionReturnData as M, dropbox as Mn, SchemaRegistryContext as Mt, APIErrorMap as N, Bot as Nn, SecureCookie as Nt, UpdateSessionAPIOptions as O, DropboxProfile as On, JoseInstance as Ot, AccessTokenError as P, NotionProfile as Pn, Severity as Pt, EditableUser as Q, SpotifyImage as Qn, JWTEncryptedMode as Qt, ErrorType as R, notion as Rn, TrustedProxyHeadersConfig as Rt, SignInReturn as S, ClickUpProfile as Sn, UserShape as Sr, CredentialsProvider as St, SignOutOptions as T, ExtendedProfile as Tn, UserShapeValibot as Tr, IdentityConfig as Tt, AuthResponse as U, Login as Un, OAuthProviderRecord as Ut, createAuth as V, PinterestProfile as Vn, OAuthProviderConfig as Vt, ConfigSchema as W, MailchimpProfile as Wn, ResponseType as Wt, EditableShapeValibot as X, XProfile as Xn, JWTConfig as Xt, EditableShapeTypebox as Y, strava as Yn, GetStatelessSessionReturn as Yt, EditableShapeZod as Z, x as Zn, JWTConfigBase as Zt, SignInCredentialsAPIReturn as _, createBuiltInOAuthProviders as _n, SchemaTypes as _r, CookieConfig as _t, OAuthEnv as a, JWTSealedMode as an, discord as ar, Prettify as at, SignInCredentialsReturnData as b, DribbbleTeams as bn, UserIdentityTypeBox as br, CookieStrategyAttributes as bt, APIOptionsWithRequest as c, JWTStrategyOptions as cn, BitbucketProfile as cr, TypeboxShapeToObject as ct, GetSessionAPIOptions as d, SessionConfig as dn, github as dr, Wrap as dt, JWTExpirationStrategy as en, spotify as er, InferSession as et, GetSessionAPIReturn as f, SessionStrategy as fn, createSyslogMessage as fr, ZodShapeToObject as ft, SignInCredentialsAPIOptions as g, builtInOAuthProviders as gn, IsZod as gr, AuthRuntimeConfig as gt, SignInAPIReturn as h, BuiltInOAuthProvider as hn, IsValibot as hr, AuthInstance as ht, JWTStandardClaims as i, JWTMode as in, Nameplate as ir, Merge as it, UpdateSessionReturn as j, RootInfo as jn, RouterGlobalContext as jt, UpdateSessionAPIReturn as k, FullTeam as kn, LogLevel as kt, APIOptionsWithSkipCSRFCheck as l, SecretKey as ln, bitbucket as lr, UserFrom as lt, SignInAPIOptions as m, User as mn, IsArkType as mr, AuthConfig as mt, AuthClientOptions as n, JWTKeyAlgorithm as nn, gitlab as nr, InferZodShape as nt, TypedJWTPayload$1 as o, JWTSignedMode as on, FigmaProfile as or, RequiredKeys as ot, OptionsWithRedirectTo as p, StatelessStrategyConfig as pn, Identities as pr, AuthAPI as pt, EditableShape as q, SummaryClub as qn, CreateSessionStrategyOptions as qt, JWTPayloadWithToken as r, JWTManager as rn, DiscordProfile as rr, LiteralUnion as rt, APIOptionsWithRedirectTo as s, JWTSigningAlgorithm as sn, figma as sr, SessionFrom as st, AuthClient as t, JWTKey as tn, GitLabProfile as tr, InferUser as tt, FunctionAPIContext as u, Session as un, GitHubProfile as ur, ValibotShapeToObject as ut, SignInCredentialsOptions as v, DribbbleDefault as vn, UserIdentity as vr, CookieName as vt, SignOutAPIReturn as w, AtlassianProfile as wn, UserShapeTypeBox as wr, HostCookie as wt, SignInOptions as x, dribbble as xn, UserIdentityValibot as xr, CredentialsPayload as xt, SignInCredentialsReturn as y, DribbbleProfile as yn, UserIdentityArkType as yr, CookieStoreConfig as yt, OAuthError as z, TwitchProfile as zn, AuthorizeParams as zt };